Subject: Bug found

From: Dan Niles <[email-masked]>
Date: Tue, 18 Mar 1997 13:40:17 -0600

Hello.  I found a bug in wu-ftpd-2.4.  Below is a description of the bug,
and a patch to fix it.  It was causing erratic denial of service for 
users with entries in the ftphosts file.

Symptoms:

Some users get odd messages and are unable to connect.  It only happens
with users that have entries in the ftpaccess file, and does not 
happen with all IP addresses.  The server core dumps, as detected by
a core file for ftpd, usually in /.

Cause:

The hosts in the ftphosts file are stored in an array called
ha_hosts[].  While checking for a matching host, this array is
sequenced. Sequencing ends when a match is found or the value returned
is NULL.  When the array is full, sequencing will go past the end of
the array, causing a core dump.

Fix:

Add a range check to the sequencing of the ha_hosts[] array.

Dan Niles

-- 
#--------------------------------#
# Dan Niles      Signatures      #
# [email-masked]   should be small #
#--------------------------------#

----------------------------- hostacc.patch --------------------------------
--- hostacc.c.orig      Tue Mar 18 12:43:10 1997
+++ hostacc.c   Tue Mar 18 13:20:25 1997
@@ -10,6 +10,9 @@
  * AUTHOR
  *      Bart Muijzer    <[email-masked]>
  *
+ * Contributor
+ *      Dan D. Niles <[email-masked]>
+ *
  * HISTORY
  *      930316  BM      Created
  *      930317  BM      Converted to local naming convention;
@@ -18,6 +21,7 @@
  *      930322  BM      Changed algorithm: not in configfile =  allow
  *                                         in configfile and match = allow|deny
  *                                         in configfile and no match = deny
+ #      970318  DDN     Fixed range checking bug on ha_hosts[]
  */
 
 #include "config.h"
@@ -79,8 +83,9 @@
                  */
                 iUserSeen = 1;
 
+                /* Added range check to prevent core dumps -DDN- */
                 for(iInd=0, pcHost=ptHtmp->ha_hosts[0];
-                    ((pcHost != NULL) && !iLineMatch);
+                    (iInd < MAXHST && (pcHost != NULL) && !iLineMatch);
                     pcHost=ptHtmp->ha_hosts[++iInd])
                 {
                         if (isdigit(*pcHost))
@@ -296,8 +301,9 @@
         int     iInd;
         hacc_t  *ptHtmp;
 
+        /* Added range check to prevent core dumps -DDN- */
         for(iInd=0, ptHtmp = ha_arr;
-            (ptHtmp->ha_hosts[iInd]);
+            (iInd < MAXHST && ptHtmp->ha_hosts[iInd]);
             iInd++)
         {
                 free(ptHtmp->ha_login);

---

From: James Hawtin <[email-masked]>
Date: Thu, 20 Mar 1997 04:52:08 +0000 (GMT)

Or if you are worried about space you could just do normal links 
(not symbolic ones) so long as your ftp archives are on the same file system.

If you read the solaris 2 faq there are good reason not to staically link 
binaries that use nsl, intl etc, such as if you patch your computer, they may 
not work, or be less secure.. or so I am lead to believe.

James.

---

From: [email-masked] (Koos van den Hout _U nix and we all_)
Date: Mon, 24 Mar 1997 17:44:34 +0100 (MET)

I haven't seen this one before, but I'm starting to see it with beta-13 :

# ftp idefix
Connected to idefix.cetis.hvu.nl.
220 idefix.cetis.hvu.nl FTP server (Version wu-2.4.2-academ[BETA-13](1) Mon Mar 24 17:07:28 MET 1997) ready.
Name (idefix:koos): koos
331 Password required for koos.
Password:
230 User koos logged in.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> dir
200 PORT command successful.
425 Can't build data connection: Cannot assign requested address.
ftp> 

When I tried to debug this, I found out the only way I can reproduce this
is when I try to ftp from the same host to the same host with root running
the ftp client. Any other combination could not reproduce that error. It
also happens some times, not always.

In case this matters, the host is running :

# uname -a
Linux idefix 2.0.24 #2 Fri Nov 15 09:16:39 MET 1996 i486

                                                Grtx KH

-- 
  Koos van den Hout,     Internetter, Unix freak, ISFJ and BBS SysOp at large
  [email-masked] (Work)  <-- finger -l for PGPkey      Fax: +31-30-2586290
  [email-masked] (Home)                      Workphone: +31-30-2586287
  http://www.cetis.hvu.nl/~koos/   Looking for a license plate with "RFC 822"